# GeoDirectory <= 2.8.193 - Authenticated (Subscriber+) Limited Arbitrary File Deletion via Path Traversal in Listing Media

- **ID:** WPSEC-2026-1390
- **Plugin:** GeoDirectory – WP Business Directory Plugin and Classified Listings Directory (`geodirectory`), https://wordpress.org/plugins/geodirectory/
- **Affected versions:** all versions before 2.8.194
- **Fixed in:** 2.8.194 (Update to 2.8.194 or later.)
- **Severity:** High 7.6 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L)
- **Weakness:** CWE-22
- **Usage among sites WPSec scans:** plugin Low, affected versions Low (as of 2026-10-21)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/geodirectory
- **Fix released:** 2026-10-20
- **Published:** 2026-10-21
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1390/

## Description

The GeoDirectory plugin for WordPress is vulnerable to Path Traversal via listing image and file field URLs in all versions up to, and including, 2.8.193. This is due to the get_external_media function turning a geodir_temp URL into a filesystem path with a plain string replacement that does not block '../' sequences. The resolved file is then moved into the uploads directory and unlinked. This makes it possible for authenticated attackers, with Subscriber-level access and above, who can submit listings to delete files outside the temporary folder, and to copy them onto their own listing. Only files whose extension is allowed for the field can be targeted (image types by default), such as media uploaded by other users.

## References

- https://wpsec.com/vuln/WPSEC-2026-1390/
- https://plugins.svn.wordpress.org/geodirectory/tags/2.8.194/
- https://wordpress.org/plugins/geodirectory/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1390/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.